CVE-2024-56663

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-56663", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.843Z", "datePublished": "2024-12-27T15:06:25.403Z", "dateUpdated": "2026-08-05T11:45:57.378Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:57.378Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\n\nSince the netlink attribute range validation provides inclusive\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\n\nOne crash stack for demonstration:\n==================================================================\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\n\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\n print_report+0xe0/0x750 mm/kasan/report.c:398\n kasan_report+0x139/0x170 mm/kasan/report.c:495\n kasan_check_range+0x287/0x290 mm/kasan/generic.c:189\n memcpy+0x25/0x60 mm/kasan/shadow.c:65\n ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\n rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\n nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\n genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\n genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\n genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\n netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:861\n netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\n netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\n netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\n sock_sendmsg_nosec net/socket.c:716 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\n ___sys_sendmsg+0x21c/0x290 net/socket.c:2553\n __sys_sendmsg net/socket.c:2582 [inline]\n __do_sys_sendmsg net/socket.c:2591 [inline]\n __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUpdate the policy to ensure correct validation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered by sending a crafted generic-netlink message (NL80211_CMD_CONTROL_PORT_FRAME / NL80211_CMD_ADD_LINK) with NL80211_ATTR_MLO_LINK_ID=15 via sendmsg() on an AF_NETLINK socket. No network traffic or radio proximity is involved in reaching the flaw.\nAC:L - A single netlink message with the out-of-range link ID deterministically reaches the off-by-one; there is no race and no condition outside the attacker's control. The attacker additionally controls the bytes adjacent to the arrays (interface MAC and link bitmaps), so the bogus pointer value and the OOB-written data are chosen, not incidental.\nPR:L - The affected nl80211 ops use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the user namespace owning the netns, which an unprivileged user obtains with `unshare -Urn`; mac80211_hwsim's NEW_RADIO is gated identically and creates an MLO-capable wiphy directly in the caller's netns. No real root in the init namespace is required.\nUI:N - The attacker performs the entire sequence itself via netlink syscalls on an interface it controls. No victim action is needed.\nS:U - The out-of-bounds accesses and resulting corruption are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - ieee80211_tx_control_port() dereferences an attacker-composed pointer (built from the settable interface MAC and link bitmaps) and copies 6 bytes of kernel memory into the source MAC of a frame that is then transmitted, giving a repeatable, attacker-directed kernel memory disclosure primitive.\nI:H - nl80211_add_link() performs a 6-byte fully attacker-controlled out-of-bounds write over wireless_dev.valid_links/radio_mask, and setting bit 15 in valid_links bypasses the NL80211_FLAG_MLO_VALID_LINK_ID checks so further handlers write chandef/beacon_interval data tens of bytes past struct wireless_dev into struct ieee80211_sub_if_data.\nA:H - The demonstrated syzkaller crash is a wild-pointer dereference (KASAN wild-memory-access) causing an oops/GPF, and the corrupted state leaves sdata->link[0]/link_conf[0] NULL with valid_links=BIT(15), so subsequent wireless operations panic the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/nl80211.c"], "versions": [{"version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "29e640ae641b9f5ffc666049426d2b16c98d9963", "status": "affected", "versionType": "git"}, {"version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "f3412522f78826fef1dfae40ef378a863df2591c", "status": "affected", "versionType": "git"}, {"version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "f850d1d9f1106f528dfc5807565f2d1fa9a397d3", "status": "affected", "versionType": "git"}, {"version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "2e3dbf938656986cce73ac4083500d0bcfbffe24", "status": "affected", "versionType": "git"}, {"version": "7a53ad13c09150076b7ddde96c2dfc5622c90b45", "status": "affected", "versionType": "git"}, {"version": "5.19.2", "lessThan": "5.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/nl80211.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.121", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.67", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.6", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/29e640ae641b9f5ffc666049426d2b16c98d9963"}, {"url": "https://git.kernel.org/stable/c/f3412522f78826fef1dfae40ef378a863df2591c"}, {"url": "https://git.kernel.org/stable/c/f850d1d9f1106f528dfc5807565f2d1fa9a397d3"}, {"url": "https://git.kernel.org/stable/c/2e3dbf938656986cce73ac4083500d0bcfbffe24"}], "title": "wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56663", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:59:54.860579Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-193", "description": "CWE-193 Off-by-one Error"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:09.931Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:52:11.640Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:52:11.640Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56663", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:59:54.860579Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-193", "description": "CWE-193 Off-by-one Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:45:25.508Z"}}], "cna": {"title": "wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered by sending a crafted generic-netlink message (NL80211_CMD_CONTROL_PORT_FRAME / NL80211_CMD_ADD_LINK) with NL80211_ATTR_MLO_LINK_ID=15 via sendmsg() on an AF_NETLINK socket. No network traffic or radio proximity is involved in reaching the flaw.\nAC:L - A single netlink message with the out-of-range link ID deterministically reaches the off-by-one; there is no race and no condition outside the attacker's control. The attacker additionally controls the bytes adjacent to the arrays (interface MAC and link bitmaps), so the bogus pointer value and the OOB-written data are chosen, not incidental.\nPR:L - The affected nl80211 ops use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the user namespace owning the netns, which an unprivileged user obtains with `unshare -Urn`; mac80211_hwsim's NEW_RADIO is gated identically and creates an MLO-capable wiphy directly in the caller's netns. No real root in the init namespace is required.\nUI:N - The attacker performs the entire sequence itself via netlink syscalls on an interface it controls. No victim action is needed.\nS:U - The out-of-bounds accesses and resulting corruption are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - ieee80211_tx_control_port() dereferences an attacker-composed pointer (built from the settable interface MAC and link bitmaps) and copies 6 bytes of kernel memory into the source MAC of a frame that is then transmitted, giving a repeatable, attacker-directed kernel memory disclosure primitive.\nI:H - nl80211_add_link() performs a 6-byte fully attacker-controlled out-of-bounds write over wireless_dev.valid_links/radio_mask, and setting bit 15 in valid_links bypasses the NL80211_FLAG_MLO_VALID_LINK_ID checks so further handlers write chandef/beacon_interval data tens of bytes past struct wireless_dev into struct ieee80211_sub_if_data.\nA:H - The demonstrated syzkaller crash is a wild-pointer dereference (KASAN wild-memory-access) causing an oops/GPF, and the corrupted state leaves sdata->link[0]/link_conf[0] NULL with valid_links=BIT(15), so subsequent wireless operations panic the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "29e640ae641b9f5ffc666049426d2b16c98d9963", "versionType": "git"}, {"status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "f3412522f78826fef1dfae40ef378a863df2591c", "versionType": "git"}, {"status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "f850d1d9f1106f528dfc5807565f2d1fa9a397d3", "versionType": "git"}, {"status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "lessThan": "2e3dbf938656986cce73ac4083500d0bcfbffe24", "versionType": "git"}, {"status": "affected", "version": "7a53ad13c09150076b7ddde96c2dfc5622c90b45", "versionType": "git"}, {"status": "affected", "version": "5.19.2", "lessThan": "5.20", "versionType": "semver"}], "programFiles": ["net/wireless/nl80211.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.121", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.67", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.6", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/wireless/nl80211.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/29e640ae641b9f5ffc666049426d2b16c98d9963"}, {"url": "https://git.kernel.org/stable/c/f3412522f78826fef1dfae40ef378a863df2591c"}, {"url": "https://git.kernel.org/stable/c/f850d1d9f1106f528dfc5807565f2d1fa9a397d3"}, {"url": "https://git.kernel.org/stable/c/2e3dbf938656986cce73ac4083500d0bcfbffe24"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\n\nSince the netlink attribute range validation provides inclusive\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\n\nOne crash stack for demonstration:\n==================================================================\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\n\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\n print_report+0xe0/0x750 mm/kasan/report.c:398\n kasan_report+0x139/0x170 mm/kasan/report.c:495\n kasan_check_range+0x287/0x290 mm/kasan/generic.c:189\n memcpy+0x25/0x60 mm/kasan/shadow.c:65\n ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\n rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\n nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\n genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\n genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\n genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\n netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:861\n netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\n netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\n netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\n sock_sendmsg_nosec net/socket.c:716 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\n ___sys_sendmsg+0x21c/0x290 net/socket.c:2553\n __sys_sendmsg net/socket.c:2582 [inline]\n __do_sys_sendmsg net/socket.c:2591 [inline]\n __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUpdate the policy to ensure correct validation."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.121", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.67", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.6", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.19.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:57.378Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56663", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:45:57.378Z", "dateReserved": "2024-12-27T15:00:39.843Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-12-27T15:06:25.403Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/nl80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "29e640ae641b9f5ffc666049426d2b16c98d9963", "status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "versionType": "git"}, {"lessThan": "f3412522f78826fef1dfae40ef378a863df2591c", "status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "versionType": "git"}, {"lessThan": "f850d1d9f1106f528dfc5807565f2d1fa9a397d3", "status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "versionType": "git"}, {"lessThan": "2e3dbf938656986cce73ac4083500d0bcfbffe24", "status": "affected", "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1", "versionType": "git"}, {"status": "affected", "version": "7a53ad13c09150076b7ddde96c2dfc5622c90b45", "versionType": "git"}, {"lessThan": "5.20", "status": "affected", "version": "5.19.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/nl80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.121", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.67", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8D3E719-D0A1-4044-AB60-B63044B0A1B3", "versionEndExcluding": "5.20", "versionStartIncluding": "5.19.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "46F9451D-F254-4A6D-A0CE-93AC2EF2FC98", "versionEndExcluding": "6.1.121", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF4F2CD1-2CA6-4D6B-9B0C-57C3C4D6544A", "versionEndExcluding": "6.6.67", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CB1A9BB-F95E-43DD-A2FD-147912FD91E5", "versionEndExcluding": "6.12.6", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\n\nSince the netlink attribute range validation provides inclusive\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\n\nOne crash stack for demonstration:\n==================================================================\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\n\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\n print_report+0xe0/0x750 mm/kasan/report.c:398\n kasan_report+0x139/0x170 mm/kasan/report.c:495\n kasan_check_range+0x287/0x290 mm/kasan/generic.c:189\n memcpy+0x25/0x60 mm/kasan/shadow.c:65\n ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\n rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\n nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\n genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\n genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\n genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\n netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:861\n netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\n netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\n netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\n sock_sendmsg_nosec net/socket.c:716 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\n ___sys_sendmsg+0x21c/0x290 net/socket.c:2553\n __sys_sendmsg net/socket.c:2582 [inline]\n __do_sys_sendmsg net/socket.c:2591 [inline]\n __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUpdate the policy to ensure correct validation."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: nl80211: correcci\u00f3n del error NL80211_ATTR_MLO_LINK_ID en uno Dado que la validaci\u00f3n del rango del atributo netlink proporciona una verificaci\u00f3n inclusiva, el *m\u00e1ximo* del atributo NL80211_ATTR_MLO_LINK_ID debe ser IEEE80211_MLD_MAX_NUM_LINKS - 1, lo que de lo contrario provocar\u00eda un error de uno. Una pila de fallos para demostraci\u00f3n: ==================================================================== ERROR: KASAN: acceso a memoria salvaje en ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Lectura de tama\u00f1o 6 en la direcci\u00f3n 001102080000000c por la tarea fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 No contaminado 6.1.70 #2 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [en l\u00ednea] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [en l\u00ednea] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [en l\u00ednea] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [en l\u00ednea] __sock_sendmsg net/socket.c:728 [en l\u00ednea] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [en l\u00ednea] __do_sys_sendmsg net/socket.c:2591 [en l\u00ednea] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Actualice la pol\u00edtica para garantizar una validaci\u00f3n correcta."}], "id": "CVE-2024-56663", "lastModified": "2026-08-04T11:22:19.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56663", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:59:54.860579Z", "version": "2.0.3"}}]}, "published": "2024-12-27T15:15:26.187", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29e640ae641b9f5ffc666049426d2b16c98d9963"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e3dbf938656986cce73ac4083500d0bcfbffe24"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f3412522f78826fef1dfae40ef378a863df2591c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f850d1d9f1106f528dfc5807565f2d1fa9a397d3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-193"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-193"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one", "id": "2334539", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334539"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "verified"}, "cwe": "CWE-193", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\nSince the netlink attribute range validation provides inclusive\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\nOne crash stack for demonstration:\n==================================================================\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\nCall Trace:\n<TASK>\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\nprint_report+0xe0/0x750 mm/kasan/report.c:398\nkasan_report+0x139/0x170 mm/kasan/report.c:495\nkasan_check_range+0x287/0x290 mm/kasan/generic.c:189\nmemcpy+0x25/0x60 mm/kasan/shadow.c:65\nieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\nrdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\nnl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\ngenl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\ngenl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\ngenl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\nnetlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\ngenl_rcv+0x24/0x40 net/netlink/genetlink.c:861\nnetlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\nnetlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\nnetlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\nsock_sendmsg_nosec net/socket.c:716 [inline]\n__sock_sendmsg net/socket.c:728 [inline]\n____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\n___sys_sendmsg+0x21c/0x290 net/socket.c:2553\n__sys_sendmsg net/socket.c:2582 [inline]\n__do_sys_sendmsg net/socket.c:2591 [inline]\n__se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\ndo_syscall_x64 arch/x86/entry/common.c:51 [inline]\ndo_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nUpdate the policy to ensure correct validation."], "name": "CVE-2024-56663", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56663\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56663\nhttps://lore.kernel.org/linux-cve-announce/2024122752-CVE-2024-56663-66d7@gregkh/T"], "threat_severity": "Moderate"}

{}